sf-plugin-permission-sets 0.0.0-dev.8 → 0.0.0-dev.80

package/messages/ps.check.md

@@ -0,0 +1,33 @@
+# summary
+
+Statically check permission set assignment files, with no org connection.
+
+# description
+
+Parse and validate the YAML files, no org needed. Reports invalid YAML, schema violations, duplicate keys, duplicate targets, and empty entries. Run it in a pre-commit hook or in CI before validate, plan, or apply.
+
+# flags.file.summary
+
+YAML file or glob to check. Repeatable.
+
+# flags.strict.summary
+
+Treat warnings as errors.
+
+# summary.counts
+
+%s errors, %s warnings.
+
+# error.failed
+
+Check found problems. See the output above.
+
+# examples
+
+- Check every file under permissions:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml"
+
+- Check specific files:
+
+  <%= config.bin %> <%= command.id %> --file permissions/sales.yml --file permissions/service.yml

package/messages/ps.export.md

@@ -0,0 +1,45 @@
+# summary
+
+Generate a YAML file from the current org's permission set assignments.
+
+# description
+
+Query the target org for every assignable permission set, group, and license assignment held by active users and write them to a single user-keyed YAML file. The result is valid input for check, validate, plan, and apply, so it is a read-only way to bootstrap adoption from an org's current state. Profile-owned permission sets and inactive users are skipped.
+
+# flags.output-file.summary
+
+Path of the YAML file to write. Created (and its parent directories) if missing, overwritten if present. Omit to write the document to stdout.
+
+# flags.user.summary
+
+Only export these users, matched on exact username. Repeatable; multiple values are a union.
+
+# flags.kind.summary
+
+Only export these scopes: permissionSets, permissionSetGroups, or permissionSetLicenses. Repeatable; combined with --user as an intersection.
+
+# success
+
+Exported %s assignments across %s users to %s.
+
+# warnNoAssignments
+
+No assignments in scope for user %s, it was skipped.
+
+# examples
+
+- Export the dev org's assignments to permissions.yml:
+
+  <%= config.bin %> <%= command.id %> --target-org dev --output-file permissions.yml
+
+- Export a production org into an environment folder:
+
+  <%= config.bin %> <%= command.id %> --target-org prod --output-file permissions/prod.yml
+
+- Write to stdout and diff against a committed snapshot:
+
+  <%= config.bin %> <%= command.id %> --target-org prod | diff - permissions/prod.yml
+
+- Export two users' permission sets and groups only:
+
+  <%= config.bin %> <%= command.id %> --target-org prod --output-file team.yml --user jdoe@acme.com --user asmith@acme.com --kind permissionSets --kind permissionSetGroups

package/messages/ps.plan.md

@@ -0,0 +1,85 @@
+# summary
+
+Preview the changes that would reconcile a target org to the assignment files.
+
+# description
+
+Load the files, resolve every user and target against the org, fetch the org's current assignments, and diff the desired state against them. Read-only: it queries the org but never changes it, so it is the apply pipeline stopping before any DML. The body shows only what the chosen mode would do, so what plan shows is what apply does. Anything the mode would not touch is reported beneath the plan as drift. Run it before apply to preview what would change.
+
+# flags.file.summary
+
+YAML file or glob to plan. Repeatable.
+
+# flags.mode.summary
+
+Which half of the reconcile to preview: additive adds and updates expirations, destructive removes only, sync does both. The plan shows only what the chosen mode would do; anything it skips is reported as drift.
+
+# flags.show-unchanged.summary
+
+List assignments that already match, instead of only counting them.
+
+# header.title
+
+Permission Set Assignments Plan
+
+# header.org
+
+Org: %s (%s)   Mode: %s
+
+# summary.counts.additive
+
+Plan: %s to add, %s to update. %s users affected.
+
+# summary.counts.destructive
+
+Plan: %s to remove. %s users affected.
+
+# summary.counts.sync
+
+Plan: %s to add, %s to update, %s to remove. %s users affected.
+
+# summary.unchanged
+
+Unchanged: %s assignments (--show-unchanged to list).
+
+# summary.unchangedListed
+
+Unchanged: %s assignments.
+
+# summary.next
+
+Next: %s
+
+# drift.additive
+
+Drift: %s undeclared assignment(s) not removed in additive mode. Run --mode sync to remove them.
+
+# drift.destructive
+
+Drift: %s declared assignment(s) not applied in destructive mode. Run --mode additive or sync to apply them.
+
+# empty.noChanges
+
+No changes. %s already matches your files.
+
+# empty.nothingToApply
+
+Nothing to apply in %s mode.
+
+# error.invalid
+
+The files do not resolve cleanly against the org. Fix the errors above, then re-run.
+
+# examples
+
+- Preview a full reconcile of the dev org:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org dev --mode sync
+
+- Preview only the additions the default additive run would make:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org dev
+
+- Preview a full reconcile of production before applying it:
+
+  <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org prod --mode sync

package/messages/ps.validate.md

@@ -0,0 +1,29 @@
+# summary
+
+Validate permission set assignment files against a target org.
+
+# description
+
+Run the same file checks as check, then resolve each referenced user, permission set, group, and license against the org. Reports users that are missing or inactive and targets that are missing or not unique. Read-only: it queries the org but never changes it. Run it before plan or apply.
+
+# flags.file.summary
+
+YAML file or glob to validate. Repeatable.
+
+# summary.counts
+
+%s errors, %s warnings.
+
+# error.failed
+
+Validation found problems. See the output above.
+
+# examples
+
+-   Validate every file under permissions against the dev org:
+
+    <%= config.bin %> <%= command.id %> --file "permissions/*.yml" --target-org dev
+
+-   Validate specific files against a named org:
+
+    <%= config.bin %> <%= command.id %> --file permissions/sales.yml --file permissions/service.yml --target-org prod

package/package.json

@@ -1,191 +1,130 @@
 {
-  "name": "sf-plugin-permission-sets",
-  "description": "",
-  "version": "0.0.0-dev.8",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/zaclummys/sf-plugin-permission-sets.git"
-  },
-  "dependencies": {
-    "@oclif/core": "^4",
-    "@salesforce/core": "^8",
-    "@salesforce/sf-plugins-core": "^12"
-  },
-  "devDependencies": {
-    "@oclif/plugin-command-snapshot": "^5.1.9",
-    "@salesforce/cli-plugins-testkit": "^5.3.10",
-    "@salesforce/dev-scripts": "^10",
-    "eslint-plugin-sf-plugin": "^1.18.6",
-    "husky": "^7.0.4",
-    "oclif": "^4.14.0",
-    "ts-node": "^10.9.2",
-    "typescript": "^5.4.5"
-  },
-  "engines": {
-    "node": ">=18.0.0"
-  },
-  "files": [
-    "/lib",
-    "/messages",
-    "/oclif.manifest.json",
-    "/oclif.lock"
-  ],
-  "keywords": [
-    "force",
-    "salesforce",
-    "salesforcedx",
-    "sf",
-    "sf-plugin",
-    "sfdx",
-    "sfdx-plugin"
-  ],
-  "license": "BSD-3-Clause",
-  "oclif": {
-    "commands": "./lib/commands",
-    "bin": "sf",
-    "topicSeparator": " ",
-    "devPlugins": [
-      "@oclif/plugin-help"
-    ],
-    "topics": {
-      "ps": {
-        "description": "Manage permission set assignments declaratively."
-      }
-    },
-    "flexibleTaxonomy": true
-  },
-  "scripts": {
-    "build": "wireit",
-    "clean": "sf-clean",
-    "clean-all": "sf-clean all",
-    "compile": "wireit",
-    "docs": "sf-docs",
-    "format": "wireit",
-    "link-check": "wireit",
-    "lint": "wireit",
-    "prepare": "husky install",
-    "postpack": "sf-clean --ignore-signing-artifacts",
-    "prepack": "sf-prepack",
-    "test": "wireit",
-    "test:nuts": "nyc mocha \"**/*.nut.ts\" --slow 4500 --timeout 600000 --parallel",
-    "test:only": "wireit",
-    "version": "oclif readme"
-  },
-  "publishConfig": {
-    "access": "public"
-  },
-  "wireit": {
-    "build": {
-      "dependencies": [
-        "compile",
-        "lint"
-      ]
-    },
-    "compile": {
-      "command": "tsc -p . --pretty --incremental",
-      "files": [
-        "src/**/*.ts",
-        "**/tsconfig.json",
-        "messages/**"
-      ],
-      "output": [
-        "lib/**",
-        "*.tsbuildinfo"
-      ],
-      "clean": "if-file-deleted"
+    "name": "sf-plugin-permission-sets",
+    "description": "Declarative, GitOps-style management of permission set assignments for Salesforce orgs.",
+    "repository": {
+        "type": "git",
+        "url": "git+https://github.com/zaclummys/sf-plugin-permission-sets.git"
     },
-    "format": {
-      "command": "prettier --write \"+(src|test|schemas)/**/*.+(ts|js|json)|command-snapshot.json\"",
-      "files": [
-        "src/**/*.ts",
-        "test/**/*.ts",
-        "schemas/**/*.json",
-        "command-snapshot.json",
-        ".prettier*"
-      ],
-      "output": []
+    "homepage": "https://github.com/zaclummys/sf-plugin-permission-sets#readme",
+    "bugs": {
+        "url": "https://github.com/zaclummys/sf-plugin-permission-sets/issues"
     },
-    "lint": {
-      "command": "eslint src test --color --cache --cache-location .eslintcache",
-      "files": [
-        "src/**/*.ts",
-        "test/**/*.ts",
-        "messages/**",
-        "**/.eslint*",
-        "**/tsconfig.json"
-      ],
-      "output": []
+    "dependencies": {
+        "@oclif/core": "^4",
+        "@salesforce/core": "^8",
+        "@salesforce/sf-plugins-core": "^12",
+        "globby": "^16",
+        "yaml": "^2",
+        "zod": "^4"
     },
-    "test:compile": {
-      "command": "tsc -p \"./test\" --pretty",
-      "files": [
-        "test/**/*.ts",
-        "**/tsconfig.json"
-      ],
-      "output": []
+    "devDependencies": {
+        "@eslint/js": "^10",
+        "eslint": "^10",
+        "execa": "^10",
+        "globals": "^17",
+        "ts-node": "^10",
+        "typescript": "^6",
+        "typescript-eslint": "^8",
+        "vitest": "^4",
+        "wireit": "^0"
     },
-    "test": {
-      "dependencies": [
-        "test:compile",
-        "test:only",
-        "lint"
-      ]
+    "engines": {
+        "node": ">=22.13.0"
     },
-    "test:only": {
-      "command": "nyc mocha \"test/**/*.test.ts\"",
-      "env": {
-        "FORCE_COLOR": "2"
-      },
-      "files": [
-        "test/**/*.ts",
-        "src/**/*.ts",
-        "**/tsconfig.json",
-        ".mocha*",
-        "!*.nut.ts",
-        ".nycrc"
-      ],
-      "output": []
+    "files": [
+        "/lib",
+        "/messages"
+    ],
+    "keywords": [
+        "salesforce",
+        "sf-plugin",
+        "sfdx-plugin",
+        "permission-sets",
+        "permission-set-assignment",
+        "permission-set-group",
+        "access-management",
+        "user-provisioning",
+        "gitops",
+        "declarative"
+    ],
+    "license": "BSD-3-Clause",
+    "oclif": {
+        "commands": "./lib/commands",
+        "bin": "sf",
+        "topicSeparator": " ",
+        "devPlugins": [
+            "@oclif/plugin-help"
+        ],
+        "topics": {
+            "ps": {
+                "description": "Manage permission set assignments declaratively."
+            }
+        },
+        "flexibleTaxonomy": true
     },
-    "test:command-reference": {
-      "command": "node --loader ts-node/esm --no-warnings=ExperimentalWarning \"./bin/dev.js\" commandreference:generate --erroronwarnings",
-      "files": [
-        "src/**/*.ts",
-        "messages/**",
-        "package.json"
-      ],
-      "output": [
-        "tmp/root"
-      ]
+    "scripts": {
+        "build": "wireit",
+        "clean": "rm -rf lib tmp *.tsbuildinfo .eslintcache .wireit",
+        "compile": "wireit",
+        "lint": "wireit",
+        "prepack": "npm run compile",
+        "test": "wireit",
+        "version": "oclif readme"
     },
-    "test:deprecation-policy": {
-      "command": "node --loader ts-node/esm --no-warnings=ExperimentalWarning \"./bin/dev.js\" snapshot:compare",
-      "files": [
-        "src/**/*.ts"
-      ],
-      "output": [],
-      "dependencies": [
-        "compile"
-      ]
+    "publishConfig": {
+        "access": "public"
     },
-    "test:json-schema": {
-      "command": "node --loader ts-node/esm --no-warnings=ExperimentalWarning \"./bin/dev.js\" schema:compare",
-      "files": [
-        "src/**/*.ts",
-        "schemas"
-      ],
-      "output": []
+    "wireit": {
+        "build": {
+            "dependencies": [
+                "compile",
+                "lint"
+            ]
+        },
+        "compile": {
+            "command": "tsc -p . --pretty --incremental",
+            "files": [
+                "src/**/*.ts",
+                "**/tsconfig.json",
+                "messages/**"
+            ],
+            "output": [
+                "lib/**",
+                "*.tsbuildinfo"
+            ],
+            "clean": "if-file-deleted"
+        },
+        "lint": {
+            "command": "eslint src --color --cache --cache-location .eslintcache",
+            "files": [
+                "src/**/*.ts",
+                "messages/**",
+                "eslint.config.js",
+                "**/tsconfig.json"
+            ],
+            "output": []
+        },
+        "test": {
+            "command": "vitest run",
+            "dependencies": [
+                "compile"
+            ],
+            "env": {
+                "FORCE_COLOR": "2",
+                "PS_TARGET_ORG": {
+                    "external": true
+                }
+            },
+            "files": [
+                "test/**",
+                "vitest.config.js",
+                ".env"
+            ],
+            "output": []
+        }
     },
-    "link-check": {
-      "command": "node -e \"process.exit(process.env.CI ? 0 : 1)\" || linkinator \"**/*.md\" --skip \"CHANGELOG.md|node_modules|test/|confluence.internal.salesforce.com|my.salesforce.com|%s\" --markdown --retry --directory-listing --verbosity error",
-      "files": [
-        "./*.md",
-        "./!(CHANGELOG).md",
-        "messages/**/*.md"
-      ],
-      "output": []
-    }
-  },
-  "exports": "./lib/index.js",
-  "type": "module",
-  "author": "Isaac Ferreira"
+    "exports": "./lib/index.js",
+    "type": "module",
+    "author": "Isaac Ferreira",
+    "version": "0.0.0-dev.80"
 }

package/lib/commands/ps/info.d.ts

@@ -1,11 +0,0 @@
-import { SfCommand } from '@salesforce/sf-plugins-core';
-export type PsInfoResult = {
-    name: string;
-    description: string;
-};
-export default class Info extends SfCommand<PsInfoResult> {
-    static readonly summary: string;
-    static readonly description: string;
-    static readonly examples: string[];
-    run(): Promise<PsInfoResult>;
-}

package/lib/commands/ps/info.js

@@ -1,17 +0,0 @@
-import { SfCommand } from '@salesforce/sf-plugins-core';
-import { Messages } from '@salesforce/core';
-Messages.importMessagesDirectoryFromMetaUrl(import.meta.url);
-const messages = Messages.loadMessages('sf-plugin-permission-sets', 'ps.info');
-export default class Info extends SfCommand {
-    static summary = messages.getMessage('summary');
-    static description = messages.getMessage('description');
-    static examples = messages.getMessages('examples');
-    async run() {
-        await this.parse(Info);
-        const name = 'sf-plugin-permission-sets';
-        const description = 'Declarative, GitOps-style management of permission set assignments.';
-        this.log(messages.getMessage('info.summary', [name, description]));
-        return { name, description };
-    }
-}
-//# sourceMappingURL=info.js.map

package/lib/commands/ps/info.js.map

@@ -1 +0,0 @@
-{"version":3,"file":"info.js","sourceRoot":"","sources":["../../../src/commands/ps/info.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,SAAS,EAAE,MAAM,6BAA6B,CAAC;AACxD,OAAO,EAAE,QAAQ,EAAE,MAAM,kBAAkB,CAAC;AAE5C,QAAQ,CAAC,kCAAkC,CAAC,MAAM,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;AAC7D,MAAM,QAAQ,GAAG,QAAQ,CAAC,YAAY,CAAC,2BAA2B,EAAE,SAAS,CAAC,CAAC;AAO/E,MAAM,CAAC,OAAO,OAAO,IAAK,SAAQ,SAAuB;IAChD,MAAM,CAAU,OAAO,GAAG,QAAQ,CAAC,UAAU,CAAC,SAAS,CAAC,CAAC;IACzD,MAAM,CAAU,WAAW,GAAG,QAAQ,CAAC,UAAU,CAAC,aAAa,CAAC,CAAC;IACjE,MAAM,CAAU,QAAQ,GAAG,QAAQ,CAAC,WAAW,CAAC,UAAU,CAAC,CAAC;IAE5D,KAAK,CAAC,GAAG;QACd,MAAM,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;QACvB,MAAM,IAAI,GAAG,2BAA2B,CAAC;QACzC,MAAM,WAAW,GAAG,qEAAqE,CAAC;QAC1F,IAAI,CAAC,GAAG,CAAC,QAAQ,CAAC,UAAU,CAAC,cAAc,EAAE,CAAC,IAAI,EAAE,WAAW,CAAC,CAAC,CAAC,CAAC;QACnE,OAAO,EAAE,IAAI,EAAE,WAAW,EAAE,CAAC;IAC/B,CAAC"}

package/messages/ps.info.md

@@ -1,17 +0,0 @@
-# summary
-
-Show information about the permission-sets plugin.
-
-# description
-
-Print the plugin name and what it does. A quick way to confirm the plugin is installed and working.
-
-# examples
-
-- Show plugin info:
-
-  <%= config.bin %> <%= command.id %>
-
-# info.summary
-
-%s - %s